CVE-2021-29483 - CVE House

Back to Database

Status published Critical CVE-2021-29483

wikiconfig API leaked private config variables set through ManageWiki

9.4 CVSS

Vulnerability Description

ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-29483

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from miraheze

View All →

DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLs

ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection

ManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensions

ManageWiki has SQL injection vulnerability in NamespaceMigrationJob

Users can impersonate import requesters if their actor IDs coincide in ImportDump

Affected Vendor

miraheze

View all reports →

Affected Software

ManageWiki

Vulnerable Versions:

< befb83c66f5b643e174897ea41a8a46679b26304

Timeline

Official Publish: April 28th, 2021

Last Modified: August 3rd, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel